WSO2 IS RemoteUserStoreManagerService Password History Bypass Allows Brute-Force
CVE-2024-2323 Published on October 20, 2026
Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery
The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted.
Exploiting this vulnerability enables an attacker to discover a user's password through brute force, leading to account impersonation. The success rate of such an attack is influenced by the complexity of the targeted user's password, with simpler passwords increasing the likelihood of compromise.
Vulnerability Analysis
CVE-2024-2323 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Weakness Type
Improper Restriction of Excessive Authentication Attempts
The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brute force attacks.
Products Associated with CVE-2024-2323
Want to know whenever a new CVE is published for Wso2 products? stack.watch will email you.
Affected Versions
WSO2 Enterprise Integrator:- Before 6.6.0 is unknown.
- Version 6.6.0 and below 6.6.0.204 is affected.
- Before 5.10.0 is unknown.
- Version 5.10.0 and below 5.10.0.286 is affected.
- Version 5.11.0 and below 5.11.0.344 is affected.
- Version 6.0.0 and below 6.0.0.188 is affected.
- Version 6.1.0 and below 6.1.0.150 is affected.
- Version 7.0.0 and below 7.0.0.35 is affected.
- Before 3.1.0 is unknown.
- Version 3.1.0 and below 3.1.0.268 is affected.
- Version 3.2.0 and below 3.2.0.354 is affected.
- Before 2.0.0 is unknown.
- Version 2.0.0 and below 2.0.0.315 is affected.
- Before 5.10.0 is unknown.
- Version 5.10.0 and below 5.10.0.283 is affected.
- Before 2.0.0 is unknown.
- Version 2.0.0 and below 2.0.0.335 is affected.
- Version 4.5.0 and below 4.5.0.4 is affected.
- Version 4.5.3 and below 4.5.3.34 is affected.
- Version 4.6.0 and below 4.6.0.137 is affected.
- Version 4.6.1 and below 4.6.1.111 is affected.
- Version 4.7.1 and below 4.7.1.51 is affected.
- Version 4.9.0 and below 4.9.0.54 is affected.
- Version 4.10.9 and below 4.10.9.20 is affected.